Security Signal

Cyber news feed

Cybersecurity news from official agencies, vendors and the security press, merged into stories and scored by how well each is confirmed.

Filtered byTopic: Vulnerability Source type: Official Vendor: AWS Clear all filters
↑
  1. Confirmed 100Vulnerability
    Published 4 Nov 2026, 19:40 UTCUpdated 15 h ago

    CVE-2026-122192 - Guest Access to Firecracker Process Memory After a Failed Memory Discard

    2 sources: AWS Security Bulletins, r/netsec
    Vendor AWS
    CVE-2026-122192
  2. Confirmed 100Vulnerability
    Published 3 Nov 2026, 18:58 UTC

    CVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypass

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-115413
  3. Confirmed 100Vulnerability
    Published 3 Nov 2026, 18:54 UTC

    CVE-2026-121652 - Stored cross-site scripting (XSS) in AWS Amplify maplibre-gl-js-amplify popup rendering

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-121652
  4. Confirmed 100Vulnerability
    Published 2 Nov 2026, 21:43 UTC

    CVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-116635
  5. Confirmed 100Vulnerability
    Published 2 Nov 2026, 21:40 UTC

    CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-105811
  6. Confirmed 100Vulnerability
    Published 2 Nov 2026, 19:19 UTC

    CVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC Workflows

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-120497
  7. Confirmed 100Vulnerability
    Published 2 Nov 2026, 16:40 UTC

    CVE-2026-119301 - Improper neutralization of quoting syntax in Apache Iceberg SQL identifier generation in AWS SDK for pandas

    Source: AWS Security Bulletins
    Impact Everyday lifeVendor AWSVendor Apache
    CVE-2026-119301
  8. Confirmed 100Vulnerability
    Published 30 Oct 2026, 16:34 UTC

    CVE-2026-119116 and CVE-2026-119148 - Issues in AWS Nitro Enclaves SDK for C

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-119116CVE-2026-119148
  9. Confirmed 100Vulnerability
    Published 29 Oct 2026, 16:58 UTC

    CVE-2026-119115 - Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-119115
  10. Confirmed 100Vulnerability
    Published 28 Oct 2026, 15:40 UTC

    CVE-2026-118029 - Unverified ownership of the default Athena query result location in AWS SDK for pandas

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-118029
  11. Confirmed 100Vulnerability
    Published 26 Oct 2026, 16:50 UTC

    CVE-2026-115418 - SQL injection in the database-query custom resource handlers in Amazon Web Services (AWS)

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-115418
  12. Confirmed 100Vulnerability
    Published 25 Oct 2026, 03:11 UTC

    CVE-2026-111943: eMudhra intermediate CA key recovery in AWS trust bundles

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-111943
  13. Confirmed 100Vulnerability
    Published 23 Oct 2026, 19:09 UTC

    CVE-2026-115845 - Incomplete validation in the run_script Python sandbox in AWS MCP Server

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-115845
  14. Confirmed 100Vulnerability
    Published 22 Oct 2026, 20:40 UTC

    CVE-2026-115417 - Memory allocation with excessive size value in the MQTT 3.1.1 compatibility adapter in aws-c-mqtt

    Source: AWS Security Bulletins
    Vendor AWS
    CVE-2026-115417